CloudFormation template to set S3 bucket default encryption

user_836318 0
Viewed 4911

S3 now supports encryption to be applied by default when individual object PUT requests do not contain a specific encryption header.

How can this be set up as part of bucket creation during CloudFormation template? I have found the API call for this but it would be great if it could be supplied as an attribute within CloudFormation rather than a separate step.

So far the only options I see are

  • make a separate API / client call after bucket creation
  • use the older way of a bucket policy to reject unencrypted requests, which can be supplied via CloudFormation S3::BucketPolicy resource
amazon-cloudformation amazon-web-services amazon-s3
2 Answers

As of some time apparently between last Friday and today, they've finally added a BucketEncryption property to S3 buckets in CloudFormation, allowing you to enable this default encryption.

user_24117840

jarmod is right, Cloudformation typically lags behind in implementing new features.

In the mean time, you could a lambda function in response to the CreateBucket event to do a put_bucket_encryption (boto3) on the bucket.

This would be using the first option you suggested but you wouldn't need to remember to make the separate api call.

user_17065040
Related